Количество 3
Количество 3
CVE-2026-91939
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
CVE-2026-91939
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unseriali ...
GHSA-xv9c-9hwm-jp8g
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-91939 Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution. | CVSS3: 9.8 | 1% Низкий | 3 дня назад |
| CVE-2026-91939 Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unseriali ... | CVSS3: 9.8 | 1% Низкий | 3 дня назад |
| GHSA-xv9c-9hwm-jp8g Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution. | CVSS3: 9.8 | 1% Низкий | 3 дня назад |
Уязвимостей на страницу